ci(release): let npm publish through Trusted publishing

.github/workflows/check-secrets.yml

@@ -5,7 +5,8 @@
 # the credential works and can reach what the release needs:
 #   - HOMEBREW_TAP_TOKEN must be able to write to dpologdvinity/homebrew-gitwhy (the Homebrew tap)
 #   - GPG_PRIVATE_KEY must import as a secret key that can sign
-# NPM_TOKEN, WINGET_TOKEN and GPG_PASSPHRASE are only checked for presence.
+# NPM_TOKEN, WINGET_TOKEN and GPG_PASSPHRASE are only checked for presence. NPM_TOKEN is optional
+# once npm Trusted publishing is set up for release.yml.
 name: check-secrets
 
 on:
@@ -29,10 +30,10 @@ jobs:
       - name: Which secrets are set
         run: |
           failed=0
-          for name in HOMEBREW_TAP_TOKEN GPG_PRIVATE_KEY NPM_TOKEN; do
+          for name in HOMEBREW_TAP_TOKEN GPG_PRIVATE_KEY; do
             if [ -n "${!name}" ]; then echo "ok:       $name is set"; else echo "MISSING:  $name (required)"; failed=1; fi
           done
-          for name in GPG_PASSPHRASE WINGET_TOKEN; do
+          for name in GPG_PASSPHRASE WINGET_TOKEN NPM_TOKEN; do
             if [ -n "${!name}" ]; then echo "ok:       $name is set"; else echo "not set:  $name (optional)"; fi
           done
           exit "$failed"

.github/workflows/release.yml

@@ -125,14 +125,17 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: read
-      id-token: write # lets npm record where the package was built (provenance)
+      id-token: write # trusted publishing, and provenance: where the package was built
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      # Node 24 brings npm 11, which publishes through npm Trusted publishing (OIDC, using the
+      # id-token permission above) when it is set up for this workflow on npmjs.com. Until then, or
+      # if it is ever removed, npm falls back to NPM_TOKEN.
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 22
+          node-version: 24
           registry-url: https://registry.npmjs.org
       - run: cp LICENSE THIRD_PARTY_LICENSES README.md npm/
       - run: npm version "${GITHUB_REF_NAME#v}" --no-git-tag-version

CONTRIBUTING.md

@@ -154,9 +154,18 @@ Repository secrets the release uses (Settings -> Secrets and variables -> Action
 | `HOMEBREW_TAP_TOKEN` | pushes the Homebrew cask and Scoop manifest to `dpologdvinity/homebrew-gitwhy` (needs Contents read and write on that repository) | yes |
 | `GPG_PRIVATE_KEY` | signs the apt and dnf repositories | yes |
 | `GPG_PASSPHRASE` | unlocks that key | only if the key has a passphrase |
-| `NPM_TOKEN` | publishes `@kaitlynbassford/gitwhy` | yes |
+| `NPM_TOKEN` | publishes `@kaitlynbassford/gitwhy` | only until npm Trusted publishing is set up (see below) |
 | `WINGET_TOKEN` | opens the winget-pkgs pull request | no (the step is skipped without it) |
 
+npm publishing works without a token once npm Trusted publishing trusts this repository's
+`release.yml`. A maintainer with two-factor authentication sets it up once:
+
+```sh
+npm login
+npm trust github @kaitlynbassford/gitwhy --repo dpologdvinity/gitwhy --file release.yml
+gh secret delete NPM_TOKEN -R dpologdvinity/gitwhy   # once npmjs.com shows the next version came from the trusted publisher
+```
+
 Before tagging, run the `check-secrets` workflow from the Actions tab: it reports which secrets are set,
 and checks that the tap token can write to the tap and that the signing key can sign. It never prints a
 secret. The `verify-install`